This invention pertains to methods, program products, computer systems and other information handling systems which enable accelerated scanning for undesirable or malicious code and, more particularly, to a computer system which trustfully tracks which files or storage locations have changed since a last virus scan and allows for accelerated virus scans by scanning only those files which have changed or files which are unchanged but which have not been scanned for new viruses.
While early computers were “stand alone” and unable to communicate with other computers, most computers today are able to communicate with other computers for a variety of purposes, including sharing data, e-mailing, downloading programs, coordinating operations, etc. This communication is achieved by logging onto a Local Area Network (LAN) or a Wide Area Network (WAN). While this expanded horizon has obvious benefits, it comes at the cost of increased exposure to mischief, particularly from viruses.
A virus is programming code that, analogous to its biological counterpart, usually infects an otherwise healthy piece of code or data. The virus causes an undesirable event, such as causing the infected computer to work inefficiently, or else fail completely. Another insidious feature of many viruses is their ability to propagate onto other computers on the network.
At least four main classes of viruses can be found including file infectors, system (or boot-record) infectors, worms and macro viruses. A file infector attaches itself to a program file. When the program is loaded, the virus is loaded as well, allowing the virus to execute its mischief. A system infector infects the registry of an operating system or specific hardware such as the master boot record in a hard disk. A master boot record infection will often make the hard drive inoperable upon a subsequent re-boot, making it impossible to boot-up the computer. A worm virus consumes memory or network bandwidth, thus causing a computer to be non-responsive. A macro virus is among the most common viruses, and infects word processor programs.
Another common type of virus is aimed at browsers and e-mail. One such virus causes a Denial of Service (DoS) attack. A DoS virus causes a website to become unable to accept visitors. Usually, such attacks cause the buffer of the website to overflow, as a result of millions of infected computers being forced (unwittingly) to hit the website.
To counter viruses, anti-viral programs are written, and are constantly updated to be effective against new viruses. Such anti-viral programs are delivered either on physical media (such as CD-ROMs), or are downloaded off a network such as the Internet. The anti-virus programs compare data on each storage device of the computer system to a virus definition file which includes all known virus signatures for all known virus types. This process is termed “scanning.” Updates are typically downloaded as well, in order to provide rapid deployment of such updates.
However, the time required to complete a virus scan is becoming increasingly unacceptable and problematic. Two factors which contribute to unacceptable scan times are the amount of data which is being scanned and the size of the virus definition file containing the identifiers. Both of these factors are growing seemingly without limits. It will soon become common for desktop systems to have disk capacities which approach one terabyte. Hackers which create viruses appear to have increasing motivation for doing so and are doing so at ever increasing rates. Meanwhile, the time it takes for scanning the hard disk does not increase significantly with increased processor speed since the time required for the scanning process is more related to disk access speeds. Problems caused by increased scan times will become more acute and more visible with time. It is foreseeable that daily virus scans will not be possible in the near future simply because, given these factors, a virus scan will eventually take longer than 24 hours to complete. Furthermore, a workstation can be rendered unusable during the time in which the scanning process takes place. Productivity is therefore impacted and eventual cost analyses will reveal that additional system cost is justified in order to rectify the problem.
Another area of background entails virtual machines and virtual machine monitors which arose out of the need to run applications written for different operating systems concurrently on a common hardware platform, or for the full utilization of available hardware resources. Virtual machine monitors were the subject of research since the late 1960's and came to be known as the “Virtual Machine Monitor” (VMM). Persons of ordinary skill in the art are urged to refer to, for example, R. P. Goldberg, “Survey of Virtual Machine Research,” IEEE Computer, Vol. 7, No. 6, 1974. During the 1970's, as a further example, International Business Machines Corporation adopted a virtual machine monitor for use in its VM/370 system.
A virtual machine monitor, sometimes referred to in the literature as the “hypervisor,” is a thin piece of software that runs directly on top of the hardware and virtualizes all the hardware resources of the machine. Since the virtual machine monitor's interface is the same as the hardware interface of the machine, an operating system cannot determine the presence of the VMM. Consequently, when the hardware interface is one-for-one compatible with the underlying hardware, the same operating system can run either on top of the virtual machine monitor or on top of the raw hardware. It is then possible to run multiple instances of operating systems or merely instances of operating system kernels if only a small subset of system resources are needed. Each instance is referred to as a virtual machine. The operating system can be replicated across virtual machines or distinctively different operating systems can be used for each virtual machine. In any case, the virtual machines are entirely autonomous and depend on the virtual machine monitor for access to the hardware resources such as hardware interrupts.